CVE-2024-38810: Missing Authorization When Using @AuthorizeReturnObject
Published Aug 20, 2024
·Updated
Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.
Affected Software
2 affected componentsFixes available
maven/org.springframework.security:spring-security-core>=6.3.0<6.3.2
6.3.2
VMware Spring Security>=6.3.0<6.3.2
Event History
Aug 20, 2024
CVE Published
via MITRE·03:35 AM
Data Sourced
via MITRE·03:35 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:31 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-38810?
CVE-2024-38810 has a high severity rating due to its potential to bypass security annotations.
2
How do I fix CVE-2024-38810?
To fix CVE-2024-38810, upgrade to Spring Security version 6.3.2 or later.
3
What versions are affected by CVE-2024-38810?
CVE-2024-38810 affects Spring Security versions 6.3.0 and 6.3.1.
4
What is the impact of CVE-2024-38810?
The impact of CVE-2024-38810 is that it allows attackers to render the @AuthorizeReturnObject security annotation ineffective.
5
Is there a workaround for CVE-2024-38810?
There are no known workarounds for CVE-2024-38810; upgrading is the recommended action.